Locally Logged on Users - why am I there?

[Guest]

I've started to notice myself (as well as many other users) logged in to many systems when I choose the View Logged on Users... option. I can't figure out where it gets this info as I know I've never logged into this system. I'm not running any services either under my user name. Any way to find out how this is happening?

[kstanush]

Re: Locally Logged on Users - why am I there?

Are you looking at the Sessions or the Logged On Users ? Let us know the steps you are taking to look at this.

Sessions and I think also the logged on users portion can show yourself when you look at a system, because Windows has to authenticate you (ie log you in) to access any remote system. Sort of like always seing yourself in the mirror...

[Guest]

Re: Locally Logged on Users - why am I there?

I'm looking at the View Logged on Users. I select a computer and then right-click to choose that option. It does make sense that I should see me as logged in since I've connected to it. However, on some systems, I've seen this

\\Training22.da.ocgov.com NT AUTHORITY\LOCAL SERVICE 8/15/2008 8:04:04 PM
\\Training22.da.ocgov.com NT AUTHORITY\NETWORK SERVICE 8/15/2008 8:04:04 PM
\\Training22.da.ocgov.com TRAINING22\Administrator 8/28/2008 12:02:47 PM
\\Training22.da.ocgov.com OCDA_MASTER\Desktop 8/28/2008 12:02:47 PM Desktop
\\Training22.da.ocgov.com OCDA_MASTER\Swood 8/28/2008 12:02:47 PM Wood, Sandy
\\Training22.da.ocgov.com OCDA_MASTER\Bcarmichael 8/28/2008 12:02:47 PM Carmichael, Beth
\\Training22.da.ocgov.com OCDA_MASTER\Dwagner 8/28/2008 12:02:47 PM Wagner, Dave
\\Training22.da.ocgov.com OCDA_MASTER\Kvega 8/28/2008 12:02:47 PM Vega, Kim
\\Training22.da.ocgov.com OCDA_MASTER\class22 8/28/2008 12:02:47 PM class22
\\Training22.da.ocgov.com OCDA_MASTER\Mluster 8/28/2008 12:02:47 PM Luster, Marianne
\\Training22.da.ocgov.com OCDA_MASTER\Pstandley 8/28/2008 12:02:47 PM Standley, Patricia
\\Training22.da.ocgov.com OCDA_MASTER\Marredondo 8/28/2008 12:02:47 PM Arredondo, Mirtha
\\Training22.da.ocgov.com OCDA_MASTER\Mlockhar 8/28/2008 12:02:47 PM Lockhart, Matt
\\Training22.da.ocgov.com OCDA_MASTER\Smarangi 8/28/2008 12:02:47 PM Marangi, Stefanie
\\Training22.da.ocgov.com OCDA_MASTER\Class1 8/28/2008 12:02:47 PM
\\Training22.da.ocgov.com OCDA_MASTER\SRV_Script_User 8/28/2008 12:02:47 PM SRV_Script_User
\\Training22.da.ocgov.com OCDA_MASTER\Pcardenas 8/28/2008 12:02:47 PM Cardenas, Patty
\\Training22.da.ocgov.com OCDA_MASTER\techman 8/28/2008 12:02:47 PM techman,
\\Training22.da.ocgov.com NT AUTHORITY\SYSTEM 8/15/2008 8:03:59 PM
Something about 8/28 at 12:02

[kstanush]

Re: Locally Logged on Users - why am I there?

When you get a moment, download the PsTools set of tools from www.sysinternals.com

It includes a utility named psloggedon which should use the same technique as Hyena to present you with a list. I want to compare the output of Hyena and psloggedon. Let me know if the output is similar.

The logon information comes from the registry, but this output does not seem right. Let ms know what O/S this particular client is as I want to see if something has changed. Terminal Server sessions might appear too, but I assume this is a plain client computer with one user logged on. The administrator and system accounts are fairly normal to see, and one user (the active user) and possibly the account you are using to access the remote computer, and any accounts used by services, but should be all.

[Guest]

Re: Locally Logged on Users - why am I there?

I ran psloggedon and the output is exactly the same as what I see in Hyena.

The system is running Windows XP SP2 and currently no one is 'logged in' to the system, it's sitting at Atl-Ctl-Del.

It sounds like a Windows thing. I'll have to pursue Microsoft on it and see what they say. Thanks for the help!

[kstanush]

Re: Locally Logged on Users - why am I there?

What is listed is coming from the HKEY_USERS key. I did find another step that can be added to show what might be the 'active' user, if that helps. An icon has been added to this screen to show this for the next update. If you want to give it an early try, let me know and I'll send you a link.

Thanks

[Guest]

Re: Locally Logged on Users - why am I there?

OK, I think I see. It pulls all the HKEY_USERS whether they are logged on or not. That makes me feel better! I was fearing somehow all these users were activly logged on!

Yes, I'd like to see the Active user option, I'm afraid I didn't get the icon you mentioned, probably a tweak on our end.